Maintaining network security is often a difficult balance of scrutinizing network traffic for threats while still sustaining network performance. In an effort to scrutinize network traffic as thoroughly as possible, larger and more powerful systems have been used to perform network threat detection processing. Unfortunately, network speeds are increasing at a rate faster than the processing capability required to completely analyze them. Today a high-end network Intrusion Detection System (IDS) can examine approximately 20% of a one-gigabit network link. Experts in the industry expect network security systems to be able to process only 4-10% of network traffic as ten-gigabit network links become the norm if current detection methods continue to be used.
A typical IDS is configured to apply the same threat detection processing to the network traffic the IDS is configured to analyze, typically ignoring certain kinds of traffic and applying the same preconfigured processing to the rest. The level of sensitivity typically is determined based on such factors as the value and importance of the network asset(s) being protected; the threat environment; the tolerance of the user or other stakeholders for the impact of threat detection processing on performance (e.g., latency, etc.); etc. In some cases, network resources have been divided into physically separate sub-networks, with more thorough threat detection processing being performed with respect to resources associated with one sub-network than the other, e.g., by segregating certain resources into a “high security” network. Typically, however, all traffic associated with a particular network or sub-network receives the same processing, with some traffic being passed without inspection and the remainder being subjected to the same processing. In such typical installations, depending on the degree of sensitivity, etc. to which threat detection systems and/or processes are tuned, innocuous traffic may be delayed unduly, e.g., while potentially traffic in line ahead of it is scrutinized, potentially\ harmful traffic may be delayed unduly in being processed and/or allowed to pass without scrutiny (or sufficiently careful scrutiny), and/or network security administrators and/or other users may be inundated with more threat reports (e.g., alerts) than they can meaningfully process. Therefore, there is a need for an effective way to maximize the threat detection processing performed with respect to potentially harmful network traffic without delaying unduly the processing of benign network traffic, including by allowing different traffic associated with the same network resource to be processed differently.